blob: 4759d0f99335c5d8e06d44fa4993f4b65f061bb8 [file] [log] [blame]
Mimi Zohar3323eec92009-02-04 09:06:58 -05001/*
2 * Copyright (C) 2008 IBM Corporation
3 * Author: Mimi Zohar <zohar@us.ibm.com>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation, version 2 of the License.
8 *
9 * ima_policy.c
10 * - initialize default measure policy rules
11 *
12 */
13#include <linux/module.h>
14#include <linux/list.h>
Mimi Zohar3323eec92009-02-04 09:06:58 -050015#include <linux/security.h>
16#include <linux/magic.h>
Mimi Zohar4af46622009-02-04 09:07:00 -050017#include <linux/parser.h>
Mimi Zohar3323eec92009-02-04 09:06:58 -050018
19#include "ima.h"
20
21/* flags definitions */
22#define IMA_FUNC 0x0001
23#define IMA_MASK 0x0002
24#define IMA_FSMAGIC 0x0004
25#define IMA_UID 0x0008
26
Mimi Zohar4af46622009-02-04 09:07:00 -050027enum ima_action { UNKNOWN = -1, DONT_MEASURE = 0, MEASURE };
28
29#define MAX_LSM_RULES 6
30enum lsm_rule_types { LSM_OBJ_USER, LSM_OBJ_ROLE, LSM_OBJ_TYPE,
31 LSM_SUBJ_USER, LSM_SUBJ_ROLE, LSM_SUBJ_TYPE
32};
Mimi Zohar3323eec92009-02-04 09:06:58 -050033
34struct ima_measure_rule_entry {
35 struct list_head list;
36 enum ima_action action;
37 unsigned int flags;
38 enum ima_hooks func;
39 int mask;
40 unsigned long fsmagic;
41 uid_t uid;
Mimi Zohar4af46622009-02-04 09:07:00 -050042 struct {
43 void *rule; /* LSM file metadata specific */
44 int type; /* audit type */
45 } lsm[MAX_LSM_RULES];
Mimi Zohar3323eec92009-02-04 09:06:58 -050046};
47
Eric Paris5789ba32009-05-21 15:47:06 -040048/*
49 * Without LSM specific knowledge, the default policy can only be
Mimi Zohar4af46622009-02-04 09:07:00 -050050 * written in terms of .action, .func, .mask, .fsmagic, and .uid
51 */
Eric Paris5789ba32009-05-21 15:47:06 -040052
53/*
54 * The minimum rule set to allow for full TCB coverage. Measures all files
55 * opened or mmap for exec and everything read by root. Dangerous because
56 * normal users can easily run the machine out of memory simply building
57 * and running executables.
58 */
Mimi Zohar3323eec92009-02-04 09:06:58 -050059static struct ima_measure_rule_entry default_rules[] = {
Eric Paris75834fc2009-05-18 10:26:10 -040060 {.action = DONT_MEASURE,.fsmagic = PROC_SUPER_MAGIC,.flags = IMA_FSMAGIC},
Mimi Zohar3323eec92009-02-04 09:06:58 -050061 {.action = DONT_MEASURE,.fsmagic = SYSFS_MAGIC,.flags = IMA_FSMAGIC},
62 {.action = DONT_MEASURE,.fsmagic = DEBUGFS_MAGIC,.flags = IMA_FSMAGIC},
63 {.action = DONT_MEASURE,.fsmagic = TMPFS_MAGIC,.flags = IMA_FSMAGIC},
Eric Paris75834fc2009-05-18 10:26:10 -040064 {.action = DONT_MEASURE,.fsmagic = SECURITYFS_MAGIC,.flags = IMA_FSMAGIC},
65 {.action = DONT_MEASURE,.fsmagic = SELINUX_MAGIC,.flags = IMA_FSMAGIC},
Mimi Zohar3323eec92009-02-04 09:06:58 -050066 {.action = MEASURE,.func = FILE_MMAP,.mask = MAY_EXEC,
67 .flags = IMA_FUNC | IMA_MASK},
68 {.action = MEASURE,.func = BPRM_CHECK,.mask = MAY_EXEC,
69 .flags = IMA_FUNC | IMA_MASK},
Mimi Zohar1e93d002010-01-26 17:02:41 -050070 {.action = MEASURE,.func = FILE_CHECK,.mask = MAY_READ,.uid = 0,
Eric Paris5789ba32009-05-21 15:47:06 -040071 .flags = IMA_FUNC | IMA_MASK | IMA_UID},
Mimi Zohar3323eec92009-02-04 09:06:58 -050072};
73
74static LIST_HEAD(measure_default_rules);
Mimi Zohar4af46622009-02-04 09:07:00 -050075static LIST_HEAD(measure_policy_rules);
Mimi Zohar3323eec92009-02-04 09:06:58 -050076static struct list_head *ima_measure;
77
Mimi Zohar4af46622009-02-04 09:07:00 -050078static DEFINE_MUTEX(ima_measure_mutex);
79
Eric Paris5789ba32009-05-21 15:47:06 -040080static bool ima_use_tcb __initdata;
81static int __init default_policy_setup(char *str)
82{
83 ima_use_tcb = 1;
84 return 1;
85}
86__setup("ima_tcb", default_policy_setup);
87
Mimi Zohar3323eec92009-02-04 09:06:58 -050088/**
89 * ima_match_rules - determine whether an inode matches the measure rule.
90 * @rule: a pointer to a rule
91 * @inode: a pointer to an inode
92 * @func: LIM hook identifier
93 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
94 *
95 * Returns true on rule match, false on failure.
96 */
97static bool ima_match_rules(struct ima_measure_rule_entry *rule,
98 struct inode *inode, enum ima_hooks func, int mask)
99{
100 struct task_struct *tsk = current;
Mimi Zohar4af46622009-02-04 09:07:00 -0500101 int i;
Mimi Zohar3323eec92009-02-04 09:06:58 -0500102
103 if ((rule->flags & IMA_FUNC) && rule->func != func)
104 return false;
105 if ((rule->flags & IMA_MASK) && rule->mask != mask)
106 return false;
107 if ((rule->flags & IMA_FSMAGIC)
108 && rule->fsmagic != inode->i_sb->s_magic)
109 return false;
110 if ((rule->flags & IMA_UID) && rule->uid != tsk->cred->uid)
111 return false;
Mimi Zohar4af46622009-02-04 09:07:00 -0500112 for (i = 0; i < MAX_LSM_RULES; i++) {
Mimi Zohar53fc0e22009-05-05 13:12:48 -0400113 int rc = 0;
Mimi Zohar4af46622009-02-04 09:07:00 -0500114 u32 osid, sid;
115
116 if (!rule->lsm[i].rule)
117 continue;
118
119 switch (i) {
120 case LSM_OBJ_USER:
121 case LSM_OBJ_ROLE:
122 case LSM_OBJ_TYPE:
123 security_inode_getsecid(inode, &osid);
124 rc = security_filter_rule_match(osid,
125 rule->lsm[i].type,
Mimi Zohar53fc0e22009-05-05 13:12:48 -0400126 Audit_equal,
Mimi Zohar4af46622009-02-04 09:07:00 -0500127 rule->lsm[i].rule,
128 NULL);
129 break;
130 case LSM_SUBJ_USER:
131 case LSM_SUBJ_ROLE:
132 case LSM_SUBJ_TYPE:
133 security_task_getsecid(tsk, &sid);
134 rc = security_filter_rule_match(sid,
135 rule->lsm[i].type,
Mimi Zohar53fc0e22009-05-05 13:12:48 -0400136 Audit_equal,
Mimi Zohar4af46622009-02-04 09:07:00 -0500137 rule->lsm[i].rule,
138 NULL);
139 default:
140 break;
141 }
142 if (!rc)
143 return false;
144 }
Mimi Zohar3323eec92009-02-04 09:06:58 -0500145 return true;
146}
147
148/**
149 * ima_match_policy - decision based on LSM and other conditions
150 * @inode: pointer to an inode for which the policy decision is being made
151 * @func: IMA hook identifier
152 * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
153 *
154 * Measure decision based on func/mask/fsmagic and LSM(subj/obj/type)
155 * conditions.
156 *
157 * (There is no need for locking when walking the policy list,
158 * as elements in the list are never deleted, nor does the list
159 * change.)
160 */
161int ima_match_policy(struct inode *inode, enum ima_hooks func, int mask)
162{
163 struct ima_measure_rule_entry *entry;
164
165 list_for_each_entry(entry, ima_measure, list) {
166 bool rc;
167
168 rc = ima_match_rules(entry, inode, func, mask);
169 if (rc)
170 return entry->action;
171 }
172 return 0;
173}
174
175/**
176 * ima_init_policy - initialize the default measure rules.
177 *
Mimi Zohar3323eec92009-02-04 09:06:58 -0500178 * ima_measure points to either the measure_default_rules or the
Mimi Zohar4af46622009-02-04 09:07:00 -0500179 * the new measure_policy_rules.
Mimi Zohar3323eec92009-02-04 09:06:58 -0500180 */
Eric Paris932995f2009-05-21 15:43:32 -0400181void __init ima_init_policy(void)
Mimi Zohar3323eec92009-02-04 09:06:58 -0500182{
Eric Paris5789ba32009-05-21 15:47:06 -0400183 int i, entries;
Mimi Zohar3323eec92009-02-04 09:06:58 -0500184
Eric Paris5789ba32009-05-21 15:47:06 -0400185 /* if !ima_use_tcb set entries = 0 so we load NO default rules */
186 if (ima_use_tcb)
187 entries = ARRAY_SIZE(default_rules);
188 else
189 entries = 0;
190
191 for (i = 0; i < entries; i++)
Mimi Zohar3323eec92009-02-04 09:06:58 -0500192 list_add_tail(&default_rules[i].list, &measure_default_rules);
193 ima_measure = &measure_default_rules;
194}
Mimi Zohar4af46622009-02-04 09:07:00 -0500195
196/**
197 * ima_update_policy - update default_rules with new measure rules
198 *
199 * Called on file .release to update the default rules with a complete new
200 * policy. Once updated, the policy is locked, no additional rules can be
201 * added to the policy.
202 */
203void ima_update_policy(void)
204{
205 const char *op = "policy_update";
206 const char *cause = "already exists";
207 int result = 1;
208 int audit_info = 0;
209
210 if (ima_measure == &measure_default_rules) {
211 ima_measure = &measure_policy_rules;
212 cause = "complete";
213 result = 0;
214 }
215 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
216 NULL, op, cause, result, audit_info);
217}
218
219enum {
220 Opt_err = -1,
221 Opt_measure = 1, Opt_dont_measure,
222 Opt_obj_user, Opt_obj_role, Opt_obj_type,
223 Opt_subj_user, Opt_subj_role, Opt_subj_type,
224 Opt_func, Opt_mask, Opt_fsmagic, Opt_uid
225};
226
227static match_table_t policy_tokens = {
228 {Opt_measure, "measure"},
229 {Opt_dont_measure, "dont_measure"},
230 {Opt_obj_user, "obj_user=%s"},
231 {Opt_obj_role, "obj_role=%s"},
232 {Opt_obj_type, "obj_type=%s"},
233 {Opt_subj_user, "subj_user=%s"},
234 {Opt_subj_role, "subj_role=%s"},
235 {Opt_subj_type, "subj_type=%s"},
236 {Opt_func, "func=%s"},
237 {Opt_mask, "mask=%s"},
238 {Opt_fsmagic, "fsmagic=%s"},
239 {Opt_uid, "uid=%s"},
240 {Opt_err, NULL}
241};
242
243static int ima_lsm_rule_init(struct ima_measure_rule_entry *entry,
244 char *args, int lsm_rule, int audit_type)
245{
246 int result;
247
248 entry->lsm[lsm_rule].type = audit_type;
249 result = security_filter_rule_init(entry->lsm[lsm_rule].type,
Mimi Zohar53fc0e22009-05-05 13:12:48 -0400250 Audit_equal, args,
Mimi Zohar4af46622009-02-04 09:07:00 -0500251 &entry->lsm[lsm_rule].rule);
252 return result;
253}
254
255static int ima_parse_rule(char *rule, struct ima_measure_rule_entry *entry)
256{
257 struct audit_buffer *ab;
258 char *p;
259 int result = 0;
260
Mimi Zohar523979a2009-02-11 11:12:28 -0500261 ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_INTEGRITY_RULE);
Mimi Zohar4af46622009-02-04 09:07:00 -0500262
263 entry->action = -1;
264 while ((p = strsep(&rule, " \n")) != NULL) {
265 substring_t args[MAX_OPT_ARGS];
266 int token;
267 unsigned long lnum;
268
269 if (result < 0)
270 break;
271 if (!*p)
272 continue;
273 token = match_token(p, policy_tokens, args);
274 switch (token) {
275 case Opt_measure:
276 audit_log_format(ab, "%s ", "measure");
277 entry->action = MEASURE;
278 break;
279 case Opt_dont_measure:
280 audit_log_format(ab, "%s ", "dont_measure");
281 entry->action = DONT_MEASURE;
282 break;
283 case Opt_func:
284 audit_log_format(ab, "func=%s ", args[0].from);
Mimi Zohar1e93d002010-01-26 17:02:41 -0500285 if (strcmp(args[0].from, "FILE_CHECK") == 0)
286 entry->func = FILE_CHECK;
287 /* PATH_CHECK is for backwards compat */
288 else if (strcmp(args[0].from, "PATH_CHECK") == 0)
289 entry->func = FILE_CHECK;
Mimi Zohar4af46622009-02-04 09:07:00 -0500290 else if (strcmp(args[0].from, "FILE_MMAP") == 0)
291 entry->func = FILE_MMAP;
292 else if (strcmp(args[0].from, "BPRM_CHECK") == 0)
293 entry->func = BPRM_CHECK;
294 else
295 result = -EINVAL;
296 if (!result)
297 entry->flags |= IMA_FUNC;
298 break;
299 case Opt_mask:
300 audit_log_format(ab, "mask=%s ", args[0].from);
301 if ((strcmp(args[0].from, "MAY_EXEC")) == 0)
302 entry->mask = MAY_EXEC;
303 else if (strcmp(args[0].from, "MAY_WRITE") == 0)
304 entry->mask = MAY_WRITE;
305 else if (strcmp(args[0].from, "MAY_READ") == 0)
306 entry->mask = MAY_READ;
307 else if (strcmp(args[0].from, "MAY_APPEND") == 0)
308 entry->mask = MAY_APPEND;
309 else
310 result = -EINVAL;
311 if (!result)
312 entry->flags |= IMA_MASK;
313 break;
314 case Opt_fsmagic:
315 audit_log_format(ab, "fsmagic=%s ", args[0].from);
316 result = strict_strtoul(args[0].from, 16,
317 &entry->fsmagic);
318 if (!result)
319 entry->flags |= IMA_FSMAGIC;
320 break;
321 case Opt_uid:
322 audit_log_format(ab, "uid=%s ", args[0].from);
323 result = strict_strtoul(args[0].from, 10, &lnum);
324 if (!result) {
325 entry->uid = (uid_t) lnum;
326 if (entry->uid != lnum)
327 result = -EINVAL;
328 else
329 entry->flags |= IMA_UID;
330 }
331 break;
332 case Opt_obj_user:
333 audit_log_format(ab, "obj_user=%s ", args[0].from);
334 result = ima_lsm_rule_init(entry, args[0].from,
335 LSM_OBJ_USER,
336 AUDIT_OBJ_USER);
337 break;
338 case Opt_obj_role:
339 audit_log_format(ab, "obj_role=%s ", args[0].from);
340 result = ima_lsm_rule_init(entry, args[0].from,
341 LSM_OBJ_ROLE,
342 AUDIT_OBJ_ROLE);
343 break;
344 case Opt_obj_type:
345 audit_log_format(ab, "obj_type=%s ", args[0].from);
346 result = ima_lsm_rule_init(entry, args[0].from,
347 LSM_OBJ_TYPE,
348 AUDIT_OBJ_TYPE);
349 break;
350 case Opt_subj_user:
351 audit_log_format(ab, "subj_user=%s ", args[0].from);
352 result = ima_lsm_rule_init(entry, args[0].from,
353 LSM_SUBJ_USER,
354 AUDIT_SUBJ_USER);
355 break;
356 case Opt_subj_role:
357 audit_log_format(ab, "subj_role=%s ", args[0].from);
358 result = ima_lsm_rule_init(entry, args[0].from,
359 LSM_SUBJ_ROLE,
360 AUDIT_SUBJ_ROLE);
361 break;
362 case Opt_subj_type:
363 audit_log_format(ab, "subj_type=%s ", args[0].from);
364 result = ima_lsm_rule_init(entry, args[0].from,
365 LSM_SUBJ_TYPE,
366 AUDIT_SUBJ_TYPE);
367 break;
368 case Opt_err:
Mimi Zohar523979a2009-02-11 11:12:28 -0500369 audit_log_format(ab, "UNKNOWN=%s ", p);
Mimi Zohar4af46622009-02-04 09:07:00 -0500370 break;
371 }
372 }
373 if (entry->action == UNKNOWN)
374 result = -EINVAL;
375
Mimi Zohar523979a2009-02-11 11:12:28 -0500376 audit_log_format(ab, "res=%d", !result ? 0 : 1);
Mimi Zohar4af46622009-02-04 09:07:00 -0500377 audit_log_end(ab);
378 return result;
379}
380
381/**
382 * ima_parse_add_rule - add a rule to measure_policy_rules
383 * @rule - ima measurement policy rule
384 *
385 * Uses a mutex to protect the policy list from multiple concurrent writers.
386 * Returns 0 on success, an error code on failure.
387 */
388int ima_parse_add_rule(char *rule)
389{
Mimi Zohar523979a2009-02-11 11:12:28 -0500390 const char *op = "update_policy";
Mimi Zohar4af46622009-02-04 09:07:00 -0500391 struct ima_measure_rule_entry *entry;
392 int result = 0;
393 int audit_info = 0;
394
395 /* Prevent installed policy from changing */
396 if (ima_measure != &measure_default_rules) {
397 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
398 NULL, op, "already exists",
399 -EACCES, audit_info);
400 return -EACCES;
401 }
402
403 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
404 if (!entry) {
405 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
406 NULL, op, "-ENOMEM", -ENOMEM, audit_info);
407 return -ENOMEM;
408 }
409
410 INIT_LIST_HEAD(&entry->list);
411
412 result = ima_parse_rule(rule, entry);
413 if (!result) {
414 mutex_lock(&ima_measure_mutex);
415 list_add_tail(&entry->list, &measure_policy_rules);
416 mutex_unlock(&ima_measure_mutex);
Mimi Zohar523979a2009-02-11 11:12:28 -0500417 } else {
Mimi Zohar4af46622009-02-04 09:07:00 -0500418 kfree(entry);
Mimi Zohar523979a2009-02-11 11:12:28 -0500419 integrity_audit_msg(AUDIT_INTEGRITY_STATUS, NULL,
420 NULL, op, "invalid policy", result,
421 audit_info);
422 }
Mimi Zohar4af46622009-02-04 09:07:00 -0500423 return result;
424}
425
426/* ima_delete_rules called to cleanup invalid policy */
James Morris64c61d82009-02-05 09:28:26 +1100427void ima_delete_rules(void)
Mimi Zohar4af46622009-02-04 09:07:00 -0500428{
429 struct ima_measure_rule_entry *entry, *tmp;
430
431 mutex_lock(&ima_measure_mutex);
432 list_for_each_entry_safe(entry, tmp, &measure_policy_rules, list) {
433 list_del(&entry->list);
434 kfree(entry);
435 }
436 mutex_unlock(&ima_measure_mutex);
437}